2 * Copyright (c) 1999 - 2002 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 /* keytab backend for HDB databases */
45 hdb_entry_ex hdb_entry
;
51 * the format for HDB keytabs is:
52 * HDB:[HDBFORMAT:database-specific-data[:mkey=mkey-file]]
55 static krb5_error_code
56 hdb_resolve(krb5_context context
, const char *name
, krb5_keytab id
)
59 const char *db
, *mkey
;
61 d
= malloc(sizeof(*d
));
63 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
67 mkey
= strstr(name
, ":mkey=");
68 if(mkey
== NULL
|| mkey
[5] == '\0') {
72 d
->dbname
= strdup(name
);
73 if(d
->dbname
== NULL
) {
75 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
81 d
->dbname
= malloc(mkey
- db
+ 1);
82 if(d
->dbname
== NULL
) {
84 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
87 memmove(d
->dbname
, db
, mkey
- db
);
88 d
->dbname
[mkey
- db
] = '\0';
90 d
->mkey
= strdup(mkey
+ 5);
94 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
102 static krb5_error_code
103 hdb_close(krb5_context context
, krb5_keytab id
)
105 struct hdb_data
*d
= id
->data
;
113 static krb5_error_code
114 hdb_get_name(krb5_context context
,
119 struct hdb_data
*d
= id
->data
;
121 snprintf(name
, namesize
, "%s%s%s",
122 d
->dbname
? d
->dbname
: "",
123 (d
->dbname
|| d
->mkey
) ? ":" : "",
124 d
->mkey
? d
->mkey
: "");
129 * try to figure out the database (`dbname') and master-key (`mkey')
130 * that should be used for `principal'.
133 static krb5_error_code
134 find_db (krb5_context context
,
137 krb5_const_principal principal
)
139 krb5_const_realm realm
= krb5_principal_get_realm(context
, principal
);
141 struct hdb_dbinfo
*head
, *dbinfo
= NULL
;
143 *dbname
= *mkey
= NULL
;
145 ret
= hdb_get_dbinfo(context
, &head
);
149 while ((dbinfo
= hdb_dbinfo_get_next(head
, dbinfo
)) != NULL
) {
150 const char *p
= hdb_dbinfo_get_realm(context
, dbinfo
);
151 if (p
&& strcmp (realm
, p
) == 0) {
152 p
= hdb_dbinfo_get_dbname(context
, dbinfo
);
155 p
= hdb_dbinfo_get_mkey_file(context
, dbinfo
);
161 hdb_free_dbinfo(context
, &head
);
163 *dbname
= strdup(HDB_DEFAULT_DB
);
168 * find the keytab entry in `id' for `principal, kvno, enctype' and return
169 * it in `entry'. return 0 or an error code
172 static krb5_error_code
173 hdb_get_entry(krb5_context context
,
175 krb5_const_principal principal
,
177 krb5_enctype enctype
,
178 krb5_keytab_entry
*entry
)
182 struct hdb_data
*d
= id
->data
;
183 const char *dbname
= d
->dbname
;
184 const char *mkey
= d
->mkey
;
185 char *fdbname
= NULL
, *fmkey
= NULL
;
189 memset(&ent
, 0, sizeof(ent
));
191 if (dbname
== NULL
) {
192 ret
= find_db(context
, &fdbname
, &fmkey
, principal
);
199 ret
= hdb_create (context
, &db
, dbname
);
202 ret
= hdb_set_master_keyfile (context
, db
, mkey
);
204 (*db
->hdb_destroy
)(context
, db
);
208 ret
= (*db
->hdb_open
)(context
, db
, O_RDONLY
, 0);
210 (*db
->hdb_destroy
)(context
, db
);
213 ret
= (*db
->hdb_fetch
)(context
, db
, principal
,
215 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
218 if(ret
== HDB_ERR_NOENTRY
) {
219 ret
= KRB5_KT_NOTFOUND
;
224 if(kvno
&& ent
.entry
.kvno
!= kvno
) {
225 hdb_free_entry(context
, &ent
);
226 ret
= KRB5_KT_NOTFOUND
;
230 if(ent
.entry
.keys
.len
> 0)
231 enctype
= ent
.entry
.keys
.val
[0].key
.keytype
;
232 ret
= KRB5_KT_NOTFOUND
;
233 for(i
= 0; i
< ent
.entry
.keys
.len
; i
++) {
234 if(ent
.entry
.keys
.val
[i
].key
.keytype
== enctype
) {
235 krb5_copy_principal(context
, principal
, &entry
->principal
);
236 entry
->vno
= ent
.entry
.kvno
;
237 krb5_copy_keyblock_contents(context
,
238 &ent
.entry
.keys
.val
[i
].key
,
244 hdb_free_entry(context
, &ent
);
246 (*db
->hdb_close
)(context
, db
);
247 (*db
->hdb_destroy
)(context
, db
);
255 * find the keytab entry in `id' for `principal, kvno, enctype' and return
256 * it in `entry'. return 0 or an error code
259 static krb5_error_code
260 hdb_start_seq_get(krb5_context context
,
262 krb5_kt_cursor
*cursor
)
265 struct hdb_cursor
*c
;
266 struct hdb_data
*d
= id
->data
;
267 const char *dbname
= d
->dbname
;
268 const char *mkey
= d
->mkey
;
271 if (dbname
== NULL
) {
273 * We don't support enumerating without being told what
274 * backend to enumerate on
276 ret
= KRB5_KT_NOTFOUND
;
280 ret
= hdb_create (context
, &db
, dbname
);
283 ret
= hdb_set_master_keyfile (context
, db
, mkey
);
285 (*db
->hdb_destroy
)(context
, db
);
289 ret
= (*db
->hdb_open
)(context
, db
, O_RDONLY
, 0);
291 (*db
->hdb_destroy
)(context
, db
);
295 cursor
->data
= c
= malloc (sizeof(*c
));
297 (*db
->hdb_close
)(context
, db
);
298 (*db
->hdb_destroy
)(context
, db
);
299 krb5_set_error_message(context
, ENOMEM
, "malloc: out of memory");
313 hdb_next_entry(krb5_context context
,
315 krb5_keytab_entry
*entry
,
316 krb5_kt_cursor
*cursor
)
318 struct hdb_cursor
*c
= cursor
->data
;
321 memset(entry
, 0, sizeof(*entry
));
325 ret
= (c
->db
->hdb_firstkey
)(context
, c
->db
,
327 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
329 if (ret
== HDB_ERR_NOENTRY
)
334 if (c
->hdb_entry
.entry
.keys
.len
== 0)
335 hdb_free_entry(context
, &c
->hdb_entry
);
341 ret
= (c
->db
->hdb_nextkey
)(context
, c
->db
,
343 HDB_F_GET_CLIENT
|HDB_F_GET_SERVER
|HDB_F_GET_KRBTGT
,
345 if (ret
== HDB_ERR_NOENTRY
)
350 /* If no keys on this entry, try again */
351 if (c
->hdb_entry
.entry
.keys
.len
== 0)
352 hdb_free_entry(context
, &c
->hdb_entry
);
358 * Return next enc type (keytabs are one slot per key, while
359 * hdb is one record per principal.
362 ret
= krb5_copy_principal(context
,
363 c
->hdb_entry
.entry
.principal
,
368 entry
->vno
= c
->hdb_entry
.entry
.kvno
;
369 ret
= krb5_copy_keyblock_contents(context
,
370 &c
->hdb_entry
.entry
.keys
.val
[c
->key_idx
].key
,
373 krb5_free_principal(context
, entry
->principal
);
374 memset(entry
, 0, sizeof(*entry
));
380 * Once we get to the end of the list, signal that we want the
384 if (c
->key_idx
== c
->hdb_entry
.entry
.keys
.len
) {
385 hdb_free_entry(context
, &c
->hdb_entry
);
395 hdb_end_seq_get(krb5_context context
,
397 krb5_kt_cursor
*cursor
)
399 struct hdb_cursor
*c
= cursor
->data
;
401 (c
->db
->hdb_close
)(context
, c
->db
);
402 (c
->db
->hdb_destroy
)(context
, c
->db
);
405 hdb_free_entry(context
, &c
->hdb_entry
);
411 krb5_kt_ops hdb_kt_ops
= {